Nubank runs fraud prevention for all of its business lines through a single Defense Platform, described by its engineers at the company's Engineering Meetup #13 and summarised on the Building Nubank blog in July 2025.
Fraud detection at Nubank used to be decentralised: each product team integrated separate systems and services, which caused inefficiencies, inconsistencies and long delays before a new defence could go live. Over five years the team replaced this with one platform designed to handle millions of events a day, integrate easily with new business lines and run reliably across regions. It now processes around 450 million events a day with over 99.98% availability in Brazil, Mexico and Colombia.
When an event such as a PIX transfer arrives with its context (origin, destination, amount and more), a Flow Orchestrator determines what it must go through; for PIX, over 40 processes, both business rules and machine learning models, may run in parallel. These draw on Nubank's feature system, which can query internal databases, third-party providers and other services. The orchestrator then decides whether the transaction proceeds or triggers an action: real-time actions such as blocking it or showing an in-app warning, or asynchronous ones such as opening an investigation case. Every event is logged into a distributed ETL system that aggregates over 100 terabytes of logs a day for analysis.
Because one event fans out into many processes, the platform generates about 5 million internal requests per minute. It runs on 20 shards, full replicas of the system, in Brazil alone, and is built on Clojure, Datomic on top of DynamoDB, and Kafka, with machine learning models written in Python and logs, traces and real-time metrics at every layer. Rules and models form a detection layer feeding an action layer; since models are slower, a model is skipped when a rule has already confidently marked a transaction as high-risk. Every new rule or model first runs in shadow mode on real inputs alongside production without affecting customers.
The original orchestrator executed components layer by layer, so fast processes waited on slow ones. The team rebuilt it as a directed acyclic graph using Nodely, an open-source library developed at Nubank, so each component waits only for the data it depends on; processing time in complex flows fell from 550 milliseconds to about 350. Next, Nubank is moving rule authoring to a declarative, configuration-based model so fraud analysts can contribute without engineering work, and adding visibility into the operational cost of each defence.